zx-bulk-release 3.1.9 → 3.1.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +5 -0
- package/README.md +5 -5
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,8 @@
|
|
|
1
|
+
## [3.1.10](https://github.com/semrel-extra/zx-bulk-release/compare/v3.1.9...v3.1.10) (2026-04-13)
|
|
2
|
+
|
|
3
|
+
### Fixes & improvements
|
|
4
|
+
* docs: add architecture notes ([8760bb8](https://github.com/semrel-extra/zx-bulk-release/commit/8760bb8b9a73593ae192a0d16eea10b731efd206))
|
|
5
|
+
|
|
1
6
|
## [3.1.9](https://github.com/semrel-extra/zx-bulk-release/compare/v3.1.8...v3.1.9) (2026-04-13)
|
|
2
7
|
|
|
3
8
|
### Fixes & improvements
|
package/README.md
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
# zx-bulk-release
|
|
2
|
-
> [zx](https://github.com/google/zx)-based
|
|
2
|
+
> A [zx](https://github.com/google/zx)-based tool for [conventional-commits](https://www.conventionalcommits.org/en/v1.0.0/)-driven secure release workflow for monorepos. Inspired by [multi-semantic-release](https://github.com/dhoulb/multi-semantic-release).
|
|
3
3
|
|
|
4
4
|
[](https://github.com/semrel-extra/zx-bulk-release/actions/workflows/ci.yml)
|
|
5
5
|
[](https://qlty.sh/gh/semrel-extra/projects/zx-bulk-release)
|
|
@@ -18,7 +18,7 @@
|
|
|
18
18
|
* **Coordinated delivery**: multiple release agents can safely serve the same monorepo concurrently via git-tag-based semaphores.
|
|
19
19
|
|
|
20
20
|
> [!NOTE]
|
|
21
|
-
> **[Migration guide v2 → v3](./MIGRATION_V2_V3.md)** | **[Delivery specification](./DELIVER_SPEC.md)** | **[Security model](./SECURITY.md)**
|
|
21
|
+
> **[Migration guide v2 → v3](./docs/MIGRATION_V2_V3.md)** | **[Delivery specification](./docs/DELIVER_SPEC.md)** | **[Security model](./docs/SECURITY.md)** | **[Architecture](./docs/ARCHITECTURE.md)**
|
|
22
22
|
|
|
23
23
|
## Roadmap
|
|
24
24
|
* [x] Store release metrics to `meta`.
|
|
@@ -122,7 +122,7 @@ jobs:
|
|
|
122
122
|
```
|
|
123
123
|
|
|
124
124
|
#### Four phases: receive + pack + verify + deliver
|
|
125
|
-
Maximum supply chain security. Each phase has strict trust boundaries. See [SECURITY.md](./SECURITY.md) for the threat model.
|
|
125
|
+
Maximum supply chain security. Each phase has strict trust boundaries. See [SECURITY.md](./docs/SECURITY.md) for the threat model.
|
|
126
126
|
|
|
127
127
|
- **receive** — runs *before* `yarn install`, consumes rebuild signals, analyzes, writes trusted context
|
|
128
128
|
- **pack** — runs *after* deps install with zero credentials, builds and packs tars
|
|
@@ -405,7 +405,7 @@ parcel.{sha7}.{channel}.{name}.{version}.{hash6}.tar
|
|
|
405
405
|
```
|
|
406
406
|
The `sha7` prefix groups all parcels of one commit. `name` is the sanitized package name (`@scope/pkg` → `scope-pkg`). The `hash6` suffix is a content hash for deduplication — two builds of the same commit producing identical content yield the same filename (last-writer-wins), while different content gets a different hash.
|
|
407
407
|
|
|
408
|
-
A **directive** meta-parcel (`parcel.{sha7}.directive.{ts}.tar`) is generated alongside regular parcels. It contains the complete delivery map: package queue, per-package channel steps, and an authoritative list of parcel filenames. The directive enables coordinated delivery — see [DELIVER_SPEC.md](./DELIVER_SPEC.md).
|
|
408
|
+
A **directive** meta-parcel (`parcel.{sha7}.directive.{ts}.tar`) is generated alongside regular parcels. It contains the complete delivery map: package queue, per-package channel steps, and an authoritative list of parcel filenames. The directive enables coordinated delivery — see [DELIVER_SPEC.md](./docs/DELIVER_SPEC.md).
|
|
409
409
|
|
|
410
410
|
The manifest contains `${{ENV_VAR}}` placeholders that are resolved by the courier at delivery time via `resolveManifest()`. This ensures credentials never touch the build phase.
|
|
411
411
|
|
|
@@ -432,7 +432,7 @@ When multiple zbr processes target the same monorepo concurrently, delivery is c
|
|
|
432
432
|
4. **Conflict resolution** — if `git-tag` returns `conflict`, all parcels of that package are marked, and a `zbr-rebuild.{sha7}` tag signals CI to rebuild with fresh versions.
|
|
433
433
|
5. **Partial delivery** — skipped parcels (missing credentials) remain valid tarballs. Another process with the right credentials can pick them up later.
|
|
434
434
|
|
|
435
|
-
See [DELIVER_SPEC.md](./DELIVER_SPEC.md) for the full protocol specification.
|
|
435
|
+
See [DELIVER_SPEC.md](./docs/DELIVER_SPEC.md) for the full protocol specification.
|
|
436
436
|
|
|
437
437
|
### Credential flow
|
|
438
438
|
```
|